Malware Analysis Report

2024-09-11 01:03

Sample ID 240726-hwk8nswgpe
Target f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe
SHA256 f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800
Tags
phobos aspackv2 credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800

Threat Level: Known bad

The file f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe was found to be: Known bad.

Malicious Activity Summary

phobos aspackv2 credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer

Phobos

Renames multiple (309) files with added filename extension

Credentials from Password Stores: Credentials from Web Browsers

Renames multiple (516) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes backup catalog

Modifies Windows Firewall

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Drops startup file

ASPack v2.12-2.42

Credentials from Password Stores: Windows Credential Manager

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Interacts with shadow copies

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-26 07:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 07:05

Reported

2024-07-26 07:07

Platform

win7-20240704-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

Signatures

Phobos

ransomware phobos

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (309) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FGBCC7A8\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLI5Q0EH\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JVMDVGRW\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9P9LRO9\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJBRRE9R\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH198YO1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G4UA8T7D\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianReport.Dotx C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSS.ICO.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\it-IT\sbdrop.dll.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\SKY.ELM.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02055_.WMF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fa.txt C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214948.WMF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115843.GIF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\THOCRAPI.DLL.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdasc.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ja.dll.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00935_.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR40F.GIF C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENV11.POC.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Discussion.gta C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198021.WMF.id[A862BB42-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2484 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2484 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2484 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2484 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 2484 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2804 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2804 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2804 wrote to memory of 2608 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2648 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2648 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2648 wrote to memory of 2976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2648 wrote to memory of 1692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2648 wrote to memory of 1692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2648 wrote to memory of 1692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2804 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2804 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2804 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2804 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2804 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2804 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2804 wrote to memory of 1076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2108 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 2484 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 3016 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3016 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3016 wrote to memory of 2372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3016 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3016 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3016 wrote to memory of 880 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3016 wrote to memory of 2248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\3c09740d.bat" "

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp

Files

memory/2484-1-0x00000000013E0000-0x00000000013F9000-memory.dmp

\Users\Admin\AppData\Local\Temp\zGrw.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/2108-11-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

memory/2484-10-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

memory/2484-9-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

memory/2696-14-0x00000000013E0000-0x00000000013F9000-memory.dmp

C:\Program Files\7-Zip\Uninstall.exe

MD5 b5749c3b44ad0e2bdf0eb0b1b4213a82
SHA1 6ef08a2ef0f9f9d74b1ac775091ee3b649b282e2
SHA256 6fdd2a20939a51af9a8623112d79688286b8f50a3f4afd6faa1986a2e12a0ade
SHA512 7c0faf31fadcbf5a5df0ee8b441fc7b6f124bc7027b30632cfadf060c7afcd07752c13654798cb9abff97f9901dda239eb1981ea206bb9074e5b2e47730acf52

memory/2108-2351-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe

MD5 f20781b44d7f5bfb952095f27654dea2
SHA1 702e51591b7b7687ca9337b15e6092d1d6acd551
SHA256 6f26bd157694c309f9eb4b64188b86a0d56775b46b927468abd9d72f99b8e44f
SHA512 0edab6e5215215f0d5b6c47c2aa2202f34eeca6949ec9b95a829ef478f491617023fb6fa36efd784ed9d2a521c005cb284247a7197156315e4a2833da2504e64

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\64812D63.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Temp\3c09740d.bat

MD5 8f599ac449d923fa7e0db0c478153015
SHA1 4199b11bd42027a02ff28570d39438e2ad7ff7fc
SHA256 9d5bc82b619294d5ff5a15c3c7880cf98f9dae454f8436e49fc29d19b29097c0
SHA512 7090ab152f78fe869ec0b2cf10cdff7cb3c4a17adc077b016fa281b04ef48852c55f53a904b7af01899a9847243213b197358b369931a7534febf4682c230c80

memory/2484-8584-0x00000000013E0000-0x00000000013F9000-memory.dmp

C:\info.hta

MD5 dc6f9cb205f18d53d20145ac9b5a78c0
SHA1 caa02010e9155ff7a19f0bfb57280b4b8b8d1060
SHA256 449d556e5c93207397d156176bbddf3e04fb0bc865e503e19c26f014171704a4
SHA512 ad2236a04642232d55ba9105c336a7c2aa4d533b13e4fcb0f06d6666991ba43f475ee7d2d2d41ff26aa77fbaf6fdc8c18263d876d8743dda67e45843baf41df6

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 07:05

Reported

2024-07-26 07:07

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

Signatures

Phobos

ransomware phobos

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (516) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800 = "C:\\Users\\Admin\\AppData\\Local\\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe" C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\file_icons.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-200.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\gnsdk_fp.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86171\javaws.exe.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyVideoProjectCreations_DarkTheme.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\LoadedModelShaders\Platform.hlsl C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\msedgeupdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\PSGet.Resource.psd1 C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoDev.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\NoteToolbox-dark.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\MSFT_PackageManagementSource.strings.psd1.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-125.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js.id[800F6EC7-3542].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\zGrw.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1428 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 1428 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 1428 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Users\Admin\AppData\Local\Temp\zGrw.exe
PID 3436 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\zGrw.exe C:\Windows\SysWOW64\cmd.exe
PID 1428 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 2600 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2600 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 8 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 8 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2600 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2600 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 8 wrote to memory of 3152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 8 wrote to memory of 3152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 8 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 8 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 8 wrote to memory of 3488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 8 wrote to memory of 3488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 8 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 8 wrote to memory of 1724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 1428 wrote to memory of 6052 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6052 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6052 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6012 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 5968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 5968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 5968 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\SysWOW64\mshta.exe
PID 1428 wrote to memory of 6112 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 1428 wrote to memory of 6112 N/A C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe C:\Windows\system32\cmd.exe
PID 6112 wrote to memory of 5136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 6112 wrote to memory of 5136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 6112 wrote to memory of 408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 6112 wrote to memory of 408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 6112 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 6112 wrote to memory of 4472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 6112 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 6112 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 6112 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 6112 wrote to memory of 1868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe

"C:\Users\Admin\AppData\Local\Temp\f604723783fbd9d194418ff08b5b30a120bc69ba91c3d74ca7ee6be20cb28800.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\69ee57cb.bat" "

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1428-0-0x00000000007E0000-0x00000000007F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zGrw.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/3436-5-0x00000000006A0000-0x00000000006A9000-memory.dmp

memory/2400-7-0x00000000007E0000-0x00000000007F9000-memory.dmp

memory/3436-18-0x00000000006A0000-0x00000000006A9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\69ee57cb.bat

MD5 4520f107bd71e6eb8484d598f2222740
SHA1 4aec9aaa7ea818ffbfa564d85cfc3c3ae1b95f03
SHA256 fab0b20f7510ffd40e50e45d3a7f12464008713a63fb2ece159bca39d7069922
SHA512 387718cdc7e3320debafc8ef830eaa0255fda1afed695473481fe5dfc65df1b91efec1beed4d718d4c055b52d8ff33e6e2931c2756ef9a923fbc13640b358d3d

C:\Program Files\7-Zip\Uninstall.exe

MD5 92339a58fbdf0fbad5159437bafd7f8c
SHA1 efc943e5736268ec64febebb3b27e1fee884599a
SHA256 db2c0f7fc8551ab0614b90cf435943b7aa65c969dba37d0b615719c8e59ae4dd
SHA512 0442e623f87ba210966252f223ab13d02014514adda143799e4318dc757cf4e1a832c6c8d6cb60891e4196acc4faeaa80df098914607166e482569c4eea86938

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[800F6EC7-3542].[[email protected]].faust

MD5 9868fd00cb10d1e0e37b8d313c28ebd8
SHA1 05c4ecb5219a74154b340f04170df87ce944460e
SHA256 33d3c2bc0dba4ac06258ce644690fbbaa14b5eab47c6b7f636d0f8bc879bea5e
SHA512 a2ad51284a04d6769f8bf3653708fa80cc4b405da3a95a746c891ab4f2f864aab01f70a14b73d55c081255f097083a28f4983fdcbc6d41fc09af6b86a2d5b3a3

memory/1428-6724-0x00000000007E0000-0x00000000007F9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\66E62D2F.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\info.hta

MD5 20304ff33976839bad061443005500e7
SHA1 c66600cf7354215007260511ee23b0c6078c66dd
SHA256 28d8c281b66cbce39c4a0a2717d0b2b9de1bc8aa948b46213fcc2ebd6e440a78
SHA512 1c032aca17b0bb5d93bde5b53abb4f21d2d9e6630131993b954f7100edde35ca7ad5af191bf730bfb91baf9c98861ac81aab37a837ca4759e2053ecbef47c622